PUBLIC DOCUMENTATION
ShortPay API and payment integration
A limited ShortPay one-time payment protocol. Documentation is public; all business APIs still require a site Bearer key on a trusted server.
Production addresses
- Server API, website, documentation, and admin
https://shortpay.ai- Hosted checkout, same-origin /checkout-api/*, and /embed.js
https://checkout.shortpay.ai
Admin browser requests stay on shortpay.ai. Use the checkout URL returned by the server unchanged.
Quick start
- Create a local order on your server.
- Call POST /v1/checkout/sessions with a stable Idempotency-Key.
- Give the returned short-lived url unchanged to the purchaser.
- Verify the raw webhook signature and deduplicate before fulfillment.
Public API
| Resource | Endpoint |
|---|---|
| Site and revenue | GET /v1/account · /v1/charges · /v1/events |
| Customers | POST /v1/customers · GET/POST /v1/customers/{id} |
| Checkout | POST /v1/checkout/sessions · Read, line items, expire |
| Payments and refunds | GET /v1/payment_intents/{id} · POST/GET /v1/refunds |
Fixed version 2025-03-31.basil; writes use URL-encoded forms. Unlisted fields are rejected.
Hosted direct card checkout
Purchasers open only the Checkout URL returned by the server. Do not receive or log card numbers/CVC yourself, or deliver goods based on redirects, iframe messages, or polling results. Status displays and authentication redirects are not payment confirmation.
Events and fulfillment
Verify ShortPay-Signature over the raw request body before parsing JSON. Events are delivered at least once; deduplicate event IDs and business order IDs in the same transaction, and verify the amount, currency, and object binding.
Visible events include payment_intent.succeeded, checkout.session.completed, checkout.session.expired, refund.updated, and refund.failed.
Authenticated management API
Management API methods, fields, responses, and authentication boundaries are fully listed in the raw reference below. Authentication and authorization still apply; public documentation does not change these boundaries.
Complete raw reference
Loading documentation…